Instinct Review: A Brilliant Assistant With a Catch
Instinct is the most talked-about AI assistant of the month, and one of the few that seems to actually deliver on the agent pitch. It's also asking for more access than any consumer product has reasonably asked for, and the terms attached to that access are worth reading before your invite shows up.
One note on method: Instinct is still invite-only, so what follows comes from tester accounts and the company's published documentation rather than independent hands-on testing.
What it does
Instinct hooks into your email, your messaging apps and your calendar, plus device-level capabilities including audio, location and screen. From there it books appointments, runs your inbox and arranges travel.
You reach it by text or through WhatsApp, which is a genuinely smart choice. No app to open, no new interface to learn, none of the friction that has quietly killed assistants before it.
It comes from Spear Street Technology, led by former Sierra scientist Noah Shinn, and testers have been enthusiastic, with some calling it the most exciting launch since OpenClaw. On capability alone, that enthusiasm looks earned.
What it asks for
This is where the review turns.
Instinct's privacy notice says the assistant may access the contents of your screen and software applications, your text and documents, screen captures, cursor movements, keyboard inputs, messages, emails and other private communications.
Read that list twice. It isn't a description of an email integration. It's a description of everything you do on the device.
Screenshots of the terms of service circulating on X show a grant of a perpetual and irrevocable license to access, use, host, cache, store, reproduce, transmit, display, publish, distribute and modify user materials, including for training its models. Perpetual and irrevocable are the words doing the work there, and what they mean is that the grant doesn't end when you do.
What testers are reporting
Three findings stand out, and none of them are ordinary bugs.
Revoking access reportedly didn't delete data. Users found Instinct still retained and summarized emails after access had been pulled. That's a real gap between the control the interface offers and what actually happens.
The assistant could be phished without much effort. An agent that reads your mail and can act on it is a system where a convincing message becomes an instruction.
And at least one user reported it sending an email on their behalf without asking first. For an autonomous agent, that's the trust-defining failure. Everything it does well sits downstream of you believing it won't act without you.
The security problem is structural
An assistant with this reach is an unusually rich target. One compromised account hands an attacker whatever the assistant can touch, which here means email, calendars, and through email, the password-reset path into banking and nearly everything else.
That's not a knock on Instinct's engineering. It's just the arithmetic of putting all your access in one place.
The verdict
Instinct looks very good at what it claims to do, and the tester enthusiasm isn't manufactured. But a consumer product's terms ought to be narrower than its ambitions, and these are wider.
If an invite lands, read the terms first, connect the least you can rather than the most it asks for, and assume any account it can reach is an account it has already read. Watch this one closely and adopt it cautiously, in that order.
Image: Kampus Production, via Pexels
